CVE-2026-58070: Guest OS Information Disclosure Flaw

CVE-2026-58070 Overview

CVE-2026-58070 is an information disclosure vulnerability that records guest operating system processing credentials in cleartext within a support log on the guest. Any local user with read access to the log file can recover privileged account credentials. The flaw is classified under [CWE-532: Insertion of Sensitive Information into Log File]. Veeam published the advisory referencing this issue in Veeam Knowledge Base Article KB4902.

Critical Impact
Local users with read access to the affected support log can extract privileged guest OS credentials in cleartext, enabling lateral movement and privilege escalation within the environment.

Affected Products

Veeam product referenced in Veeam Knowledge Base Article KB4902
Guest operating systems processed by the affected Veeam component
Environments where the support log is accessible to non-administrative users

Discovery Timeline

2026-08-26 - CVE-2026-58070 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-58070

Vulnerability Analysis

The vulnerability stems from improper handling of sensitive authentication material during guest OS processing operations. Credentials supplied for guest interaction are written to a support log file in cleartext rather than being redacted, hashed, or excluded from log output. The log resides on the guest system itself, which increases the exposure surface.

Any principal with read access to the support log can harvest privileged credentials. Because the log is generated as part of normal support and troubleshooting workflows, the sensitive data can persist across sessions and remain available long after the operation completes.

Root Cause

The root cause is a logging design flaw categorized as [CWE-532]. The application emits credential values through its diagnostic logging pipeline without applying sanitization filters. Attackers do not need to break authentication or bypass access controls on the credentialed service. They only need file-system read access to the log location on the guest.

Attack Vector

The attack vector is local. An authenticated user on the guest OS with read permissions on the support log reads the file and extracts credentials. The attacker then reuses those credentials to authenticate as the privileged account, expanding access to systems and data the account can reach. No user interaction beyond log access is required.

No public exploit code is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to Veeam Knowledge Base Article KB4902 for vendor technical details.

Detection Methods for CVE-2026-58070

Indicators of Compromise

Access events on the affected Veeam guest OS support log by accounts that do not perform legitimate support functions.
Authentication activity for privileged guest OS accounts originating from hosts or users that previously read the support log.
Unexpected copy, archive, or exfiltration operations targeting the support log file path on guest systems.

Detection Strategies

Audit file-system read access on the Veeam support log path referenced in KB4902 and alert on non-administrative reads.
Correlate log-read events with subsequent privileged authentication attempts using the same account context.
Scan existing support logs for credential patterns to identify historical exposure that predates remediation.

Monitoring Recommendations

Enable object-access auditing on guest OS log directories and forward events to a centralized SIEM.
Baseline expected readers of the support log and generate alerts for deviations.
Monitor privileged account usage for anomalies that follow support or backup job execution windows.

How to Mitigate CVE-2026-58070

Immediate Actions Required

Apply the vendor guidance published in Veeam Knowledge Base Article KB4902 as soon as the update is available in your environment.
Restrict read permissions on the affected support log to administrators only until the fix is deployed.
Rotate any privileged guest OS credentials that may have been recorded in existing support logs.

Patch Information

Veeam has published remediation details in Veeam Knowledge Base Article KB4902. Follow the vendor-supplied upgrade or configuration steps to eliminate cleartext credential logging on the guest.

Workarounds

Tighten NTFS or POSIX permissions on the support log directory so that only trusted administrative accounts hold read access.
Purge existing support logs that contain cleartext credentials after collecting any needed forensic evidence.
Rotate service accounts used for guest OS processing and enforce least privilege on those accounts to limit blast radius if credentials are exposed again.

bash

# Configuration example: restrict access to the guest support log directory
# Windows (PowerShell) - remove non-admin read access
icacls "C:\ProgramData\Veeam\Backup" /inheritance:r
icacls "C:\ProgramData\Veeam\Backup" /grant:r "Administrators:(OI)(CI)F" "SYSTEM:(OI)(CI)F"

# Linux - restrict guest support log directory to root
chown -R root:root /var/log/veeam
chmod -R 700 /var/log/veeam